What is the CVSS score of EUVD-2026-39693?

EUVD-2026-39693 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Paytium are affected by EUVD-2026-39693?

The Paytium WordPress plugin (versions ≤5.0.2), used for Mollie payment processing and donations, contains an unauthenticated privilege escalation vulnerability (CVSS 9.8) that allows any…

How to fix or mitigate EUVD-2026-39693?

24 hours: Identify all WordPress installations running Paytium plugin; audit active version numbers; assess scope of customer payment data stored or processed. 7 days: Deactivate and remove Paytium plugin versions ≤5.0.2 from all affected installations; if immediate removal creates operational hardship, implement compensating controls (WAF rules, access restrictions, enhanced logging). 30 days: Migrate to alternative vetted payment processor (e.g., WooCommerce native gateway, Stripe for WordPress) or evaluate Paytium patch status if released.

Paytium EUVD-2026-39693

| CVE-2026-56030 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-06-26 audit@patchstack.com

GHSA-h9xr-fprq-hcr8

WordPress Privilege Escalation Wordpress Plugin

9.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Privilege escalation reachable by unauthenticated network requests with low complexity (AV:N/AC:L/PR:N/UI:N); gaining elevated WordPress rights yields high confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:41 vuln.today

DescriptionCVE.org

Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions.

AnalysisAI

Unauthenticated privilege escalation in the Paytium WordPress plugin (Mollie payment forms and donations) through version 5.0.2 allows remote attackers with no authentication to gain elevated privileges, with CVSS 9.8 indicating full compromise of confidentiality, integrity, and availability. The flaw stems from incorrect privilege assignment (CWE-266), meaning a low- or no-privilege actor can be granted rights they should not have. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Paytium is a WordPress plugin that integrates Mollie to build payment, subscription, and donation forms on WordPress sites, running within the PHP/WordPress request lifecycle and relying on WordPress's role and capability model. The root cause is classified as CWE-266 (Incorrect Privilege Assignment), where the application assigns a privilege level to an actor that exceeds what is intended - typically because a registration, role-setting, or capability-handling routine is reachable without proper authorization or fails to validate the requesting user's actual rights. Because the affected component is exposed over the network without authentication (per the CVSS vector AV:N/PR:N), the privilege-granting logic can be reached by anonymous requests rather than being gated behind an authenticated administrative context. Exact CPE data was not provided in the input; affected scope is identified from the Patchstack advisory as the Paytium plugin for WordPress.

RemediationAI

No vendor-released patch version is identified in the available data, so confirm the current fixed release directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/paytium/vulnerability/wordpress-paytium-plugin-5-0-2-privilege-escalation-vulnerability?_s_id=cve) and the plugin's WordPress.org page, then upgrade to the first release above 5.0.2 once published. Until a fix is confirmed and applied, compensating controls include deactivating and removing the Paytium plugin entirely if payment functionality is not currently required (trade-off: payment/donation forms go offline), or placing the site behind a WordPress-aware web application firewall (such as Patchstack's own virtual patching) to block anonymous requests to the plugin's privilege-affecting endpoints (trade-off: virtual patches may lag and require tuning). Additionally, restrict access to wp-admin and registration endpoints and audit user accounts and roles for unexpected privilege grants created during the exposure window (trade-off: account auditing is manual but catches prior abuse).